# AI News Report, October 30: CURSOR: BACKDOORED CLAUDE CODE EXTENSION HIT UP TO 5,000 USERS > Source: > Published: 2026-10-30 15:54:08+00:00 The card lists a 1M-token context and fp8 weights under a modified MIT license; hosted resale needs a separate deal. Mistral cites 48% on Artificial Analysis' Coding Agent Index. Researchers ran a command through Cursor's agent and read whole disks from Codex and VS Code, which they say are still unpatched. Do not click file links an agent writes in an untrusted project. Draft 0.1 of the Document Parsing Protocol shows each source page beside its expected output and ships as a Claude skill. Use it as an answer key when you test a PDF parser. The world models are 26,000 to 131,000 parameters and fit the board's 520 KB of SRAM, across five games including Doom-lite. It is the smallest working world model you can read end to end. It is Apache-2.0 on macOS, Linux and Windows, and runs terminals on SSH machines too. Telemetry is on by default, so turn it off under Settings, Privacy. He cloned his voice from a talk clip and blended it with designed voices for a kids' game. He warns that is enough for a halfway convincing fake phone call. OpenAI released GPT-6.1 Terra on October 26, marketing it as a cheap, fast model for high-volume everyday work, priced at The post GPT-6.1 Terra vs… · The New Stack Most people who try to run a model at home end up with a $3,000 graphics card that sits idle twenty hours a day and a chatbot that forgets the… · Codez (@0xCodez) The status page says to assume all environment variables were decrypted, and users report their AI keys were used. If you deploy there, rotate every key today. Vapor Panda's ARTEX agents used about 1.4 billion input tokens in one intrusion. CrowdStrike's fix list starts with rotating signing keys and requiring IMDSv2. The stake is staged on jobs and revenue milestones, and Cohere commits C$1.7 billion to Canadian compute by 2030. Enterprise buyers get a well-funded non-US model vendor. The $10-a-share deal makes ADT the base of Thrive's smart home security business, with OpenAI supplying models and engineers. No new AI products are named yet. Preliminary Clearinghouse data shows -12.4% at 4-year schools and -10.4% at the graduate level. Watch how this shapes the junior hiring pool in a few years. Under 35, the gap is about three weeks, and workers with more transferable skills did better. Goldman says it is still too early to judge the full impact. Each reached another customer's Key Vault or SQL data through Logic Apps API Connections. Scope connection tokens and keys to the least access they need. The BriefA tampered build of Anthropic's Claude Code extension, version 2.1.313, sat in Cursor's extension marketplace for about 11 hours on October 29 and reached at most 5,000 users; Cursor says Anthropic did not build it. It adds an attacker's SSH key and a startup task that survive uninstalling, and sends host details to a server Cursor says is now offline. If anyone on your team uses Cursor, run Cursor's check today and rotate credentials on any machine that had it. Level UpRun code --list-extensions --show-versions on each developer machine and keep the output, so the next bad build takes one search to rule out. The same page shows the extensions.autoUpdate setting and Install Another Version for pinning. →VS Code docs: Extension Marketplace (auto-update, versions, command line)